DOM-based XSS
XSS variant where exploit never touches server — vulnerable JavaScript on client reads user input (URL hash, location, localStorage) and evals/innerHTMLs it without sanitization.
Classic: document.getElementById('container').innerHTML = location.hash → URL #<img onerror=alert(1) src=x> triggers. Server-side defenses (escape on output) DO NOT help — exploit happens client-side. Defense: avoid innerHTML, use textContent, escape user data before DOM manipulation, Trusted Types (Chrome API that forces safe-by-construction). React + Vue minimize via JSX auto-escape. Single-page apps have higher DOM-XSS surface because all rendering is client-side. CSP is best mitigation: 'unsafe-eval' off + nonce-based script allowance.